Tweet
Tweet

Slide 1

Slide 1 text

N a vig a ting the SBOM l a ndsc a pe: Form a ts, relev a nce, a nd tooling in 2024 Viktor Petersson vpetersson.com

Slide 2

Slide 2 text

$ who a mi

Slide 3

Slide 3 text

Wh a t a re SBOMs?

Slide 4

Slide 4 text

Why now?

Slide 5

Slide 5 text

Wh a t a re SBOMs used for?

Slide 6

Slide 6 text

An a lysis Coll a bor a tion Gener a tion

Slide 7

Slide 7 text

Gener a tion

Slide 8

Slide 8 text

The e a sy w a y. Kind a .

Slide 9

Slide 9 text

The form a t w a r

Slide 10

Slide 10 text

from

Slide 11

Slide 11 text

from

Slide 12

Slide 12 text

The tools

Slide 13

Slide 13 text

Generic

Slide 14

Slide 14 text

Dom a in speci f ic tools

Slide 15

Slide 15 text

Completeness & enrichment

Slide 16

Slide 16 text

Tr a nsitive vs. prim a ry dependencies

Slide 17

Slide 17 text

No content

Slide 18

Slide 18 text

Source vs. Build vs. Run

Slide 19

Slide 19 text

But w a it...there's more

Slide 20

Slide 20 text

Product SBOM Project SBOM(s) Component SBOM(s) Smart Thermostat Backend IoT Device Python SBOM Node SBOM Docker SBOM Rust SBOM Project SBOM Project SBOM

Slide 21

Slide 21 text

But wh a t a bout security?

Slide 22

Slide 22 text

Coll a bor a tion

Slide 23

Slide 23 text

H a ndling SBOMs tod a y feels like m a n a ging source code in the 90s, with p a tches sent over em a il.

Slide 24

Slide 24 text

Vendor 1 sbomify Vendor 2 Vendor 3 Buyer 1 Buyer 2 Buyer 3 SBOM(s) SBOM(s) SBOM(s) Compliance Audit Security Audit License Audit

Slide 25

Slide 25 text

An a lysis

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

Big Picture

Slide 28

Slide 28 text

Product SBOM Project SBOM(s) Component SBOM(s) Smart Thermostat Backend IoT Device Python SBOM Node SBOM Docker SBOM Rust SBOM Project SBOM Project SBOM

Slide 29

Slide 29 text

OBOM CBOM SaaSBOM HBOM ML-BOM VEX Product SBOM Smart Thermostat

Slide 30

Slide 30 text

St a te of SBOMs

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

Q & A

Slide 35

Slide 35 text

More re a ding • NTIA Minimum Elements • Fr a ming Softw a re Component Tr a nsp a rency: Est a blishing a Common Softw a re Bill of M a teri a ls (SBOM) (2nd edition) • 3nd edition is rele a sed shortly • SBOM Resources • CISA Working Group: SBOM Gener a tion • Sh a meless self plug: sbomify • Slides will be a v a il a ble on vpetersson.com/ a bout Sc a n for deep dive!